Gain a comprehensive overview of physical or virtual devices managed by a Cortex XDR agent and execute direct response actions.
Navigate to → → → to view your inventory of physical and virtual endpoints, such as PCs, laptops, servers, and mobile devices, that are protected by an installed Cortex XDR agent.
Note
The device assets inventory requires deployed Cortex XDR agents, which are included with Cortex XSIAM Enterprise and Premium licenses, or available as an add-on for Cortex XSIAM NG-SIEM.
The device inventory tracks vital operational and connectivity data for each asset. Analysts can view the endpoint status to see if the agent is Connected, Disconnected, or Lost, the operational status to verify if the endpoint is Protected, Partially Protected, or Unprotected, as well as the Agent Version, Operating System, and the last logged-in User.
For deeper visibility, device assets support Host Insights. This feature collects extensive business and IT operational data from the endpoint, including installed applications, autoruns, mounted disks, local user groups, and running services. This allows analysts to quickly identify anomalies, such as a suspicious service or an unauthorized autorun added to a device.
Because these device assets are actively managed by the XDR agent, analysts can execute direct response actions on the asset during an investigation. Supported actions include:
Isolating the Endpoint: Halting all network access on the device (except for traffic to Cortex XSIAM) to prevent a compromised device from communicating with other internal or external networks.
Live Terminal: Initiating a remote connection to manage files, active processes, and run system commands.
Script Execution & File Retrieval: Running Python scripts directly on the device or retrieving specific files (up to 20 files or 500MB) for further forensic analysis.
To ensure the device inventory remains accurate and clutter-free, administrators can perform one-time or periodic cleanups of duplicated entities. If a device is removed, its data is retained for 90 days from the last connection timestamp, and the data will be seamlessly recovered if the device reconnects to Cortex XSIAM in the future.